fix: Remove default BeforeHookCreation hook deletion policy

controller/hook.go

@@ -226,17 +226,12 @@ func (ctrl *ApplicationController) cleanupHooks(hookType HookType, liveObjs map[
 		deletePolicies := hook.DeletePolicies(obj)
 		shouldDelete := false
 
-		if len(deletePolicies) == 0 {
-			// If no delete policy is specified, always delete hooks during cleanup phase
-			shouldDelete = true
-		} else {
-			// Check if any delete policy matches the current hook state
-			for _, policy := range deletePolicies {
-				if (policy == common.HookDeletePolicyHookFailed && aggregatedHealth == health.HealthStatusDegraded) ||
-					(policy == common.HookDeletePolicyHookSucceeded && aggregatedHealth == health.HealthStatusHealthy) {
-					shouldDelete = true
-					break
-				}
+		// Only delete hooks if they have an explicit deletion policy that matches the current state
+		for _, policy := range deletePolicies {
+			if (policy == common.HookDeletePolicyHookFailed && aggregatedHealth == health.HealthStatusDegraded) ||
+				(policy == common.HookDeletePolicyHookSucceeded && aggregatedHealth == health.HealthStatusHealthy) {
+				shouldDelete = true
+				break
 			}
 		}
 

gitops-engine/pkg/sync/doc.go

@@ -37,8 +37,9 @@ The annotation value indicates the sync operation phase:
   - SyncFail - executes when the sync operation fails.
   - Sync - executes after all PreSync hooks completed and were successful, at the same time as the apply of the manifests.
 
-Named hooks (i.e. ones with /metadata/name) will only be created once. If you want a hook to be re-created each time
-either use BeforeHookCreation policy (see below) or /metadata/generateName.
+Named hooks (i.e. ones with /metadata/name) will only be created once and will persist across syncs unless explicitly
+deleted using a hook deletion policy (see below). If you want a hook to be re-created each time, use /metadata/generateName
+or the BeforeHookCreation deletion policy.
 
 The same resource hook might be executed in several sync phases:
 
@@ -59,13 +60,17 @@ Hooks can be deleted in an automatic fashion using the annotation: argocd.argopr
 	    argocd.argoproj.io/hook: PostSync
 	    argocd.argoproj.io/hook-delete-policy: HookSucceeded
 
-Hook deletion policies are governed by sync success and failure. A successful sync operation requires all hooks to complete successfully. A sync will fail if _any_ hooks fail.
-The following policies define when the hook will be deleted.
+By default, hook resources are NOT automatically deleted and will persist in the cluster. Hook deletion policies allow
+you to control when hooks should be automatically deleted. Policies are governed by sync success and failure. A successful
+sync operation requires all hooks to complete successfully. A sync will fail if _any_ hooks fail.
+The following policies define when the hook will be deleted:
 
   - HookSucceeded - the hook resource is deleted if the sync succeeds
   - HookFailed - the hook resource is deleted if the sync fails.
   - BeforeHookCreation - the hook resource is deleted if it exist at the start of the sync.
 
+Note: If no deletion policy is specified, hooks will persist and must be manually deleted or pruned.
+
 # Sync Waves
 
 The waves allow to group sync execution of syncing process into batches when each batch is executed sequentially one after

gitops-engine/pkg/sync/hook/delete_policy.go

@@ -19,8 +19,6 @@ func DeletePolicies(obj *unstructured.Unstructured) []common.HookDeletePolicy {
 	for _, p := range helmhook.DeletePolicies(obj) {
 		policies = append(policies, p.DeletePolicy())
 	}
-	if len(policies) == 0 {
-		policies = append(policies, common.HookDeletePolicyBeforeHookCreation)
-	}
+	// No default deletion policy - hooks should only be deleted when explicitly configured
 	return policies
 }

gitops-engine/pkg/sync/hook/delete_policy_test.go

@@ -10,8 +10,9 @@ import (
 )
 
 func TestDeletePolicies(t *testing.T) {
-	assert.Equal(t, []common.HookDeletePolicy{common.HookDeletePolicyBeforeHookCreation}, DeletePolicies(testingutils.NewPod()))
-	assert.Equal(t, []common.HookDeletePolicy{common.HookDeletePolicyBeforeHookCreation}, DeletePolicies(testingutils.Annotate(testingutils.NewPod(), "argocd.argoproj.io/hook-delete-policy", "garbage")))
+	// No default deletion policy - hooks are only deleted when explicitly configured
+	assert.Empty(t, DeletePolicies(testingutils.NewPod()))
+	assert.Empty(t, DeletePolicies(testingutils.Annotate(testingutils.NewPod(), "argocd.argoproj.io/hook-delete-policy", "garbage")))
 	assert.Equal(t, []common.HookDeletePolicy{common.HookDeletePolicyBeforeHookCreation}, DeletePolicies(testingutils.Annotate(testingutils.NewPod(), "argocd.argoproj.io/hook-delete-policy", "BeforeHookCreation")))
 	assert.Equal(t, []common.HookDeletePolicy{common.HookDeletePolicyHookSucceeded}, DeletePolicies(testingutils.Annotate(testingutils.NewPod(), "argocd.argoproj.io/hook-delete-policy", "HookSucceeded")))
 	assert.Equal(t, []common.HookDeletePolicy{common.HookDeletePolicyHookFailed}, DeletePolicies(testingutils.Annotate(testingutils.NewPod(), "argocd.argoproj.io/hook-delete-policy", "HookFailed")))